The vulnerability is a policy bypass in the ServiceWorker implementation of Google Chrome that allows a maliciously crafted HTML page to defeat the browser’s Content Security Policy. An attacker who can host such a page that a user visits can inject scripts, load forbidden resources, and bypass script restrictions, potentially leading to theft of sensitive information or execution of malicious code.

This issue affects Google Chrome desktop builds earlier than version 147.0.7727.55. All browsers prior to that release are vulnerable; the security update that mitigates the flaw is included in Chrome 147.0.7727.55 and later.

The CVE carries a Chromium security severity of Low, no EPSS score is available, and it is not listed in CISA’s KEV catalog. Exploitation requires a user to open a crafted HTML page, so the attack vector is remote web content. While it may be mitigated by user awareness, the safest approach is to update the browser promptly. No workaround has been provided by the vendor.